Recently we have made pen-test on Magento 2.3.3 version.
We have received the following issues.
Vulnerable Javascript Library Versions In Use
adminhtml/Magento/backend/en_US/jquery/jquery-ui-1.9.2.js adminhtml/Magento/backend/en_US/knockoutjs/knockout.js adminhtml/Magento/backend/en_US/jquery.js
Can we upgrade these library files to latest versions?
How this can be achieved? Can anyone help me with the steps to implement it.
Thanks in Advance!!
asked Oct 30, 2019 at 10:51
Jafar Pinjar
1,9117 gold badges71 silver badges147 bronze badges
1 Answer 1
Go to app\design\frontend\Vendor\Theme\Magento_Theme\layout\default_head_blocks.xml. create if not exist
<page xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:View/Layout/etc/page_configuration.xsd">
<head>
<!--Remove default jquery, or it will cause conflict-->
<remove src="lib\web\jquery\jquery.js"/>
<remove src="lib\web\knockoutjs\knockoutjs.js"/>
<remove src="lib\web\jquery\jquery-ui.js"/>
<!--Include CDN-->
<script
src="https://code.jquery.com/jquery-3.2.1.min.js"
integrity="sha256-hwg4gsxgFZhOsEEamdOYGBf13FyQuiTwlAQgxVSNgt4="
crossorigin="anonymous" src_type="url"></script>
<script
src="https://cdnjs.cloudflare.com/ajax/libs/knockout/3.5.0/knockout-debug.js"
integrity="sha256-hwg4gsxgFZhOsEEamdOYGBf13FyQuiTwlAQgxVSNgt4="
crossorigin="anonymous" src_type="url"></script>
<script
src="https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/jquery-ui.js"
integrity="sha256-hwg4gsxgFZhOsEEamdOYGBf13FyQuiTwlAQgxVSNgt4="
crossorigin="anonymous" src_type="url"></script>
</head>
-
hi @Divyesh, what about knockoutjs and jquery-ui file? how can we upgrade them?Jafar Pinjar– Jafar Pinjar2019年10月30日 11:31:07 +00:00Commented Oct 30, 2019 at 11:31
-
same you can try with knockout .Divyesh– Divyesh2019年10月30日 11:39:49 +00:00Commented Oct 30, 2019 at 11:39
-
can you pls update code for other 2 js as well?Jafar Pinjar– Jafar Pinjar2019年10月30日 11:43:36 +00:00Commented Oct 30, 2019 at 11:43
-
check updated answer @jafarpinjarDivyesh– Divyesh2019年10月30日 11:48:34 +00:00Commented Oct 30, 2019 at 11:48
-
okay let me try this.Jafar Pinjar– Jafar Pinjar2019年10月30日 11:57:24 +00:00Commented Oct 30, 2019 at 11:57
default